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Homeland Security 



U:S. Department of IffKKMM 



United States 
Coast Guard 



Commanding Officer 
United States Coast Guard 
Aviation Training Center 



MEMO 



From: 



8501 Tanner Williams Road 

Mobile. AL 36608-8322 

Staff Symbol: hsd 

Phone: (251)441-6878 

Fax: (251)441-6926 

Email: pstewart-kuhn@atc.uscg.mil 

6000 

7 June 2004 




Reply to 
Attn of: 





To: 
Via: 

Subj: 

1 . A Pharmacy Quality Assurance assist visit was conducted at AIRSTA Miami on May 26-27, 2004. 
This visit came at the request of the Command, and the Chief, Health Services Division. 



2. The. 



tality Assurancechecklist was used as a guideline for this visit 



_ ie following items are requirements of the QA cl 

to be corrected to conform with current guidelines and standards. 



ETandnel 



a. (J.2) The pharmacy policy and procedure manual does not reflect current practice. This 
document should be reviewed and revised. Items not currently reflected in this document include 
the returned goods program for expired pharmaceuticals; procedures for CHCS computer entry; 
double count procedures on controlled substance prescriptions, and the peipetual list of 
controlled substance prescriptions. Recommend a three-month timeframe for the completion of 
this update. 

b. (J.6.a) A review of the clinic formulary was conducted. This document does not reflect current 
medications stocked in the pharmacy. Update should be completed within three months. The 
formulary should then be reviewed and revised on a six-month schedule. 

c. (J.6.b) The clinic does not have a HS Formulary. A template of a prior clinic HS formulary was 
located. This document can be used to create a new HS formulary. A second option would be to 
indicate the HS Formulary items in the "comments" section of the current formulary. Update 
should be completed within three months. The HS Formulary should then be reviewed and 
revised on a six-month schedule. 

d. (18) Unauthorized individuals, including family members, should not permitted unaccompanied 
access to restricted areas of the clinic, including the pharmacy. 

e. (J. 10) Expired medications were found in the urgent care, crash cart, night locker, and clinic 
exam rooms. Medications in all areas of the clinic are responsibility of the pharmacy. The crash 
cart needs to be inspected each month to ensure all items are accounted for, and expired 
medications are removed and replaced. The clinic "night locker" should be removed from the 
crash cart. These items need to be labeled 1AW Chapter 10 of the Medical Manual. Items 
currently stocked in the night locker should be reviewed and revised. Expired medications were 
removed from exam rooms and will need to be replaced. The crash cart and night locker should 
be reviewed and revised within three months. All spaces should be inspected on a monthly basis. 
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f. (J. 14) The "special order" list is not current. Reviewed procedures for generating a product 
activity report (PAR) and drug utilization report (DUR) in CHCS. These reports will assist in the 
completion of the "special order" list. List should be updated within three months, and revised 
on a six-month schedule. 

g. (J.23) Controlled substance inventories are being conducted as required, but are not on a regular 
4*5 week basis. Recommend the Command appoint a ^"JOLIUfimher of fhf * a11 **'* board to be a 
central point of contact for the pharmacy. Recommend & a <VHHH|HHHPhe audit board 
determine a regular schedule (i.e. first Wednesday of each month) to conduct the narcotic audits. 

h. (J.27) All prescriptions for schedule D controlled substances should be linedthroudyind 
initialed by the individual posting the transaction. This item was noted i^flHHHHB^fcd 
shpul^^mplgngited immediately. 

i. (H)^HHHHHHHH^as not performed any pharmacy monitoring and evaluation (M&E) 
e^rcisSnoHnS^^s required. Discussed and reviewed available M&E exercises, 
procedures for completing drug utilization reports (DUR) to find appropriate patients, and 
procedures to complete the M&E. 

j . (D) The pharmac^y^ycimjentl^tCKildng the required amounts of CBR pharmaceuticals, IA W 
the HSAL Part 1 -^HH| B is to order the needed quantities of Cipro SOOmg tablets and 
Amoxicillin 250mgcnewaDl^fDJets within the next week. Stocks of CBR pharmaceuticals 
should be stored in a separate area of the pharmacy from regular working stock. ^ 



3. pie following items were noted and reviewed with BHHBHHr^ ese represent areas where 
improvements are needed: 

a. I have concerns with the customer service ben^^^^ec^ybe pharmacy. During the visit, a 
patient requested a refill on her medication. ^HHHHHFrefused to process the refill. He 
informed the patient that the pharmacy policy required that all patjei^^^^headfor refills, and 
that he could not violate this policy. I discussed this issue ^^^fHJ^HHfj^Hr and reminded 
him that customer service is paramount. If his policy inhibits the provision of patient care, it 
should be re-evaluated. 

b. The P&T Committee Meetings arf being held and documented on a quarterly basis. However, 
the scope and content of the minutes is rather limited. It is recommended that changes in Coast 
Guard policies relating to pharmacy be discussed and documented at these meetings. Examples 
include the changes to the civilian pharmacy Jfenefit, and the new Hepatitis B immunization 
program. 

c. The Controlled Substance audits and processes were reviewed. It is recommended that items no 
longer stocked be removed from the audit form CG 5353. All records should be kept for three 
years. 

d. The pharmacy is currently providing patients a full copy of the clinic formulary upon their 
request. However, this document is several pages long, and contains notes such as "active duty 
personnel only" which could generate customer complaints. Recommend providing a one-page 
formulary for patients to take with them. A template will be provided via E mail. 

e. Reviewed the vaccines in the lab, which are ordered by the pharmacy. There were a number of 
vials getting ready to expire. These should be transferred to another DOD or Coast Guard 
facility for use if at all possible. In addition, there were several v^^^y^rentl^tocked with 

vials from two manufacturers for the same product. Recommend^||PHHHP^ ucate t ^ e 
lab tech/HS staff that vaccines are sometimes manufactured by different companies under 
different names, but are the same product, (i.e. Engerix and Recombivax are both brands of 
Hepatitis B vaccine) 
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4. The following arc recommendations for improving workflow and job performance. 

a. The pharmacy manuals and various Coast Guard publications were reviewed. Many items had 
out of date instructions and manuals, which have now been discarded. The pharmacy has ready 
access to all current health care publications via printed copy in the pharmacy, as well as via the 
G-WKH website. 

b. A copy of the MLCLANT Pharmacy Collateral Duty RespojsiM^ Miami 
was not available. A copy of this d^umen^whichoutl^ to 
outlyi n g units , was req uested from fl||H|HHflHBBF^^" discussion with 

, they have been receivin^aequat^harmacy officer support froi 

comprehensive review of CHCS pharmacy module reports and menus. HB^ 
not have access to the pharmacy cost reports (KPR) or ad-hoc labels (LaS). The 
clinic CHCS administrator enabled ^ces^jyhesynenus on Thursday morning. Reviewed and 
processed the following reports with Jmj^^HjHfe pharmacy cost reports (KPR) by drug 
cost, number of prescriptions filled, arid^aSenRategOTy; creating ad-hoc labels (LAB) for pre- 
packing night lockerpMications; volume summary report (VSR); product activity report (PAR) 
to determine quantities of items used; DEA reports for controlled substance tracking; drug 
utilization reviews (DUR) for processing monitoring and evaluatio^gLercises^ndformulary 
maintenance menus (FOM). Copies of these reports were left with^|||mm^for easy 
reference. 1 f 

d. Reviewed the current prime vendor ordering system with Cardinal. DiscussecHhaUhe contract is 
up for reissu e this summer, and information has been disseminated frompP|B at G-WKH- 
2. CurrentlyHHHHBHBiises a "stand alone" computer with mode^^^^^yij^ardinal 
orders. However^araiiiafflas instituted In^ne^ase^rfiring, which tHHHffHV^ 
using for his remote units. Recommend tha^JJJBBB^requestthat Cardinal load the 
AIRSTA Miami account on to the Internet system, andthe^U^Bfcccount be reactivated. 
The pharmacy can then discontinue the use of the stand-alonecomputS-. This will allow the use 
of Internet based ordering for all units, and free up some space in the pharmacy when the 
computer is gone. 

e. Discussed prim^endoijtaten^ Miami witlHIH Blinic 
administrator iy^^^^^^^H^I ^M(|MBpRecommend ISCnMmmh^nSer the 
supervision o ^HHI^^P^ aflow^ Internet orders for pharmaceuticals, 
as they managethenrowi^^mc ^H^SIlBBB^BBHB^^" P r <^if}^X£I2*ghyrf ordering 
during his weekly visit to 4flHH0" Ti^i^ntoTietwebsite. ^||HJH|Pu ueed access 
to the Cardinal website, an^ramingon the ordering system. 

f . Provided an Internet link to the DOD Pharmacoeconomic Center (PEC) website. Printed out a 
copy of th^nostrecen^asic Core Formulary (BCF) for reference. 

g. Current! j£HHHIH|^ having another individual countersign all of his narcotic 
transactionl^^i^s not required under any Coast Guard guidelines, but can be continued at 

discretion. 

5. Please contact me if you have any questions concerning the quality assurance assist visit. Thank you 
for the opportunity to assist your clinic. 



-> 
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U.S. Department of Homeland Security 



Commanding Officer (kh) 
U.S.C.O. Integrated Support 
100 Mac Arthur Causeway 
Miami Beach, FL 33139 



14750NW44 lh Crt. 
Opa Locka FI., 33054 
305-953-2263 



To whom it may concern: 

1 over heard Cmdr. A. Sokolowski say " Fuck you Willfe; J can get you on that" The 
approximate date and time I do not remember. 



eimer 




WW i "JJ I 
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Cacho, Willie CDR 



From: 
Sen* 
To: 
Subject 




1 1:22 AM 



IE: Urgent 



J, 




— -Original 

From: 
Sent: 
To: 
Subject: 




04 11:06 AM 




—Original Message — 
Fkiom: Gordon, Stanley CDR 

Sent: Thursday, July 01, 2004 10:35 AM 

To: CactK), Wffite CDR 
Subject: FW: Urgent 

FY! 



— Original Messafle^Si 
Rrom: 



jj^t^TJPrrraii 



7:05 AM 
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U.S. Department of 
Homeland Security 

United States 
Coast Guard 




Commandant 

United States Coast Guard 



2100 Second Street, S.W. 
Washington, DC 20593-0001 
Staff Symbol: CG-1 122 
Phone: (202) 267-0801 
Fax: (202) 267-4685 
Email:dnoyes@comdt.uscg.mil 

6010 

20 October 2005 



MEMORANDUM 

From: D. R. NoyeS, CAPT 

CG HIPAA Privacy Officer 
CG-1 122 

To: CDR Willie Cacho 



Reply to CG-1 122 
Attn of: CAPTObrams 

202-267-0846 



J 



Subj: INVESTIGATION INTO THE HEALTH INFORMATION PRIVACY COMPLAINT 
AGAINST USCG FILED WITH TMA DATED 08 FEB 2005 

Ref: (a) Health Information Portability and Accountability Act, Public Law 104-191 
(b) COMDTINST M5830.1, Administrative Investigations Manual 

Preliminary Statement 

1. Per references (a) and (b), a review was conducted, concluding 16 May 2005, concerning the 
circumstances leading to the Health Information Privacy Complaint that you filed with the TMA 
Privacy Office against the USCG dated 08 February 2005. Per COMDTINST M 5830.1, if an 
incident requires administrative investigation under more than one regulation, it is Coast Guard 
policy that a single investigation be utilized as long as all command and program requirements 
are met. Accordingly, the extensive investigation that the Commanding Officer, Air Station 
Miami, directed, was used to review the circumstances that led to the referenced Health 
Information Privacy Complaint. The completion of this review was delayed due to the necessity 
of legal input at multiple steps in the investigative process. 

Findings of Fact 

1 . A comprehensive investigation was conducted from 2 1 July through 23 August 2004 at Air 
Station Miami concerning the circumstances surrounding the pharmacy quality assurance survey 
conducted by an employee during the week of 28 June 2004. Numerous witnesses were 
interviewed by the investigating officer. Actions taken by the XO, A/S Miami, included some 
disciplinary actions. 

2. You stated on the Health Information Privacy Complaint Form and on interview that you were 
dissatisfied that the Coast Guard had taken no apparent action, and that therefore you elevated 
your HIPAA complaint to the TMA Privacy Office. 

Opinions 

1 . An employee committed an intentional breach of patient confidentiality by accessing your 
entire health record inappropriately. While it is proper to communicate minimum necessary PHI 
to the Commanding Officer when it relates to fitness for duty, your PHI was additionally 
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Subj : INVESTIGATION INTO HEALTH INFORMATION 60 1 

PRIVACY COMPLAINT FILED WITH TMA 08 FEB 2005 

20 October 2005 

communicated inappropriately to others at the A/S Miami clinic, and then used to attempt to 
threaten you. 

2. There appears to have been intentional, not accidental, unauthorized effort to access PHI and 
then use it to threaten you. 

Actions 

1 . Appropriate additional disciplinary action has been taken against the employee who 
perpetrated the violation. 

cc: (1) TMA Privacy Office 

(2)CG-112 
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U.S. Department of [MH/RRf 



Homeland Security 

United States 
Uoast Guard 



Commanding Officer 
United States Coast Guarq 
Air Station Miami 



MEMO 



14750 NW 44th CT 
Opa-locka, FL 33054-2397 
Staff Symbol: AVENG 
Phone: (305) 953-2202 
Fax: (305) 953-2251 
Email: 



5800 

23 Aug 2004 



From: 




Reply to 
Attn of: 



To: 
Thru: 

Subj: 




G^ 



INVESTIGATION INTO THE CIRCUMST 
ASSURANCE CHECKS PERFORMED B 



THE QUALITY 




Ref: (a) CG Administrative Investigation Manual, COMDTINST M5830. 1 

(b) Manual for Courts-Martial United States 

(c) Military Justice Manual, COMDTINST M5810.1D 

Preliminary Statement 

1 . Per reference (a), (b) and (c), an investigation was conducted concerning the circumstances 
surrounding the Quality Assurance Checks of Air Station Miami's Health Records involving 
controlled substances during the week of 28 June 2004. All available evidence has been 
collected and documented. 

2. The completion of this investigation was delayed due to a Focused Review of Air Station 
Miami's Clinic during the week of 2 August 2004 and preparation for Hurricane Charley. 

Finding of Facts 




2. CDR Gordon is the Quality Assurance Coordinator for Air Station Miami's Health Services 
Department. As such, he assigns quarterly Monitoring and EvaluatioiiiM&E^ exercises on a 
random basis. While CDR Cacho was TAD to the CGC Eai 





not meet 



____ jwed 27 cases while completing the M&E DUR-8 
'hich met the criteria of the M&E DUR-8. One other unidenti 
[ecnteria outlined in the M&E DUR-8 (Enclosure (6)). 




4. The data collection methodology for the M&E DUR-8 requires the QA coordinator or 
pharmacy staff to review prescription forms CG5344, NAVMED 6710/1 1, and DD1289 for 
schedule II through V medications and ensure the patient has signed the back of the prescription 
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Subj: INVESTIGAT ION INTO THE CIRCUMS TANCES 
.OUNDING 



5800 




23 Aug 2004 



form. Then the QA coordinator or pharmacy staff will review the patient health record to ensure 
a corresponding prescription entry is made for all schedule II through V medications (Enclosure 
(4, 6, 10-13)). 



5. After completing the M&E DUR-8 




7. The Pharmacy Quality Assurance Assist Visit conducted b ^^^^^^ 
several items in the Air Station Miami Pharmacy that needed improvemen 




rifled 
e (23)). 




1 0. Public Health Service Officers assigned to the Coast Guard are subject to military law and 
have the military status equivalent of commissioned officers of the Coast Guard (Enclosure (19 
20)). 





_ ended the Coast Guard Direct Commissioned Officer Training at the 
emy from 2 Aug 2004 to 3 Sep 2004 (Enclosure (21)). 



Opinions 



>1- „ 

when lie assign* 



deployed to the C 
the M&E DUR-8 to 




Uowed normal procedures 
acts (1,2)). 



^^_^_^ When completing an M&E DUR-8, the QA coordinator or 
pharmacy staff snouia only check the S] 
schedule CJI through CV medications. 
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23 Aug 2004 




Recommendations 




A 
•J 



Enclosure: 



V 



# 

(1) CDR Willie Cacho TAD orders to CGC Eagle 

(2) Summary of the interview betw< 

(3) Summary of the interview betw( 

(4) Summary of the interview betw< 

(5) Summary of the interview betwee n^ 

(6) Monitoring and Evaluation report, rroper proceaures tor con! 
substance prescripts * ' 

(7) E-mail betw 

(8) E-mail between 

(9) Medication: 

(10) E-mail b 

(11) E-mail betw 

(12) E-mail betw 

(13) E-mail betwe 

(14) E-mail between 

(15) E-mail between 

(16) Summary of thej 

(17) Statement from 
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uSubj: INVESTIGATION INTO THE CIRCUMSTANCES 

SURROUND ING THE QUALITY AS STTR A1 

PERT! 



5800 




23 Aug 2004 



(18) Summary of telephone interview betwe< 

(19) Coast Guard Pi 
(20] 




(25) Investigation 

(26) CG4910 



designation Letter 
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Summary of Interview 
with CDR Stanley Gordon 

On 28 July 2004 CDR Alan Carver interviewed CDR Stanley Gordon, Senior Dental Officer, 
Deputy Chief of Health Services Department and Quality Assurance Coordinator for Coast 
Guard Air Station. The interview was conducted at 1 100 in Air Station Miami Commanding 
Officer's conference room. 

CDR Carver started the interview by briefly explaining he was conducting a single individual 
informal investigation into the circumstances surrounding the Quality Assurance (QA) Checks of 
Air Station Miami's Health Records involving controlled substances during the week of 28 June 
2004. Following that, CDR Carver asked CDR Gordon if he wanted to start with a statement of 
what he knew about the QA check. 

CDR Gordon stated that as the QA Coordinator he assigns Monitoring and Evaluation (M&E) on 
a quarterly basis to each of the sections within Health Services Division. He assigns the QA 
check randomly to ead^ectioi^n^i^iad assigned Proper Procedures for Co ntrolled Substance 
Rxs (M&E DUR-8) ■■■■■■^fter completing the M&E DUR^, 1 ^" 




The data collection methodology for the M&E DUR-8 calls for a rev iew of prescription forms 
prior to reviewing patient health records. 




2004 that 




This is an accurate summary of the oral statement 




ENCLOSURE ( X ) 
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Summary of Interview 
with CDR Willie Cacho 



On 30 July 2004 CDR Alan Carver interviewed CDR Wille Cacho, 584-08-1849, Senior 
Medical Officer, Chief of Health Services Department and Quality for Coast Guard Air 
Station. The interview was conducted at 0900 in Air Station Miami Commanding 
Officer's conference room. j 

CDR Carver started the interview by briefly explairiing he was conducting a single 
individual informal investigation into the circumstances surrounding the Quality 
Assurance (QA) Checks of Air Station Miami's Health Records involving controlled 
substances during the week of 28 June 2004. 




While CDR Cacho was TAD to the CGC Eagle, CDR Stanley Gord on, Deputy Chief of 
[ealth Services Department at Air Station Miami was acting Chief. 




After receivi 






also provided CDR Carver a copy of the M&E DUR-8 thai 

Tiile reviewing it, CDR Cacho's SSN was found as case number eight 

and that it had met the data collection methodology! 
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This is an accurate summary of the oral stateme 
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Summary of Interview 
with LT Jerald R. Jarvi 



On 4 August 2004 CDR Alan Carver interviewe 




CDR Carver started the interview by briefly explaining he was conducting a single individual 
informal investigation into the circumstances surrounding the Quality Assurance (QA) Checks of 
Air Station Miami's Health Records involving controlled substances during the week of 28 June 
2004. 





This is an accurate summary of the oral statement 





ENCLOSURE ( H ) 
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Accountability Act. If you have received this email in error, please advise the sender immediately and delete the entire message together 
with all attachments. Ail unintended recipients are hereby notified that any use, distribution, copying or any other action regarding this email 

is strictly prohibited. 



— Original M 
From: 




In step (b) of the data collection methodology section, the ua coordinator orpnarmacy 
staff will review the patient health record to ensure that a corresponding prescription entry 
was made for all identified schedule II through V prescriptions. Could you help me with the 
following questions? 

1. What items in the health records should be checked to ensure a corresponding 

is made? 

he reviewer or data collector will take the controlled substance prescription and mirror it 
wttn a neaitn recora entry. He/she will look at the date the prescription was written, go to the health record and 
look for the corresponding date in the health record (SF600 section), then verify that health record entry for the 
prescription was made. No further review is required. 

2. What items are normally checked during a M&E DUR-8? ■■■■■■VThe only 

requirements is patient's health record entry of the same drug as written orun^rescnptio^usually DD1289 
or CG5344) and patient's signature on back of the prescription. 

3. Have you had the opportunity t o conduct a M&E DUR-8 in the past, and if so what items 

did you CheckTflHHHMH^jHBrhis particular M&E came out during my tenure at CG HQ clinic and I 
have conducted itl^B^^W^^^^^d at the prescription, verified in the patient's health record that the 
same drug was written on the same date, and verified patient signature. Looking in the health record does not 
require detailed review 



4. Should the QA Coordinator or pharmacy staff check the health record for pres cription 

>T identified as schedule II through V while completing a M&E DUR-8?j 

^ If conducting only this particular M&E, it does not require the reviewer to check for an; 
per the criteria indicated in section 2 of DUR-8. 



thgl^^^^P' 

otnenharu5er 



i oription 

lytning eise 



Thank you for your help in this matter. 




Note: This is an internal document that is predecisional and deliberative in nature. This document is not 
to be released or disclosed until the originator has been consulted and a releasability determination has 
been made. 

OjLtjtu 
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Carver, Alan CDR 

mmmmmmmmmmmmmmmmmmmmmmmmm 



From: 
Sent: 
To: 
Subject: 




004 4:16 PM 



&8 DUR-8 



for an official policy regarding HIPPA, I would refer you to 
office. She is on global. 




he is our HIPPA expert here at the 



In my opinion, and only my opinion, not legal opinion, I would say that if an individual started looking for information in a 
patient's health record outside of the scope of his intended target (DUR - 8), and utilized that information in a "negative 
way", then it is violating the privacy of the patient. But that is my opinion. I see it still as patient-doctor confidentiality and 
something that should be regarded even by someone who can or has the capability to see things 




USCG HQ, G-WKH-2 

2100 SECOND STREET, SW, Rm 5314 

i^hington, DC 20593 

mfong@comdtuscg.mil 

This communication and its attachments are confidential to the Coast Guard Health Care Program and to the intended recipient(s). Information 

contained in this communication may be subject to the provisions of the Privacy Act of 1 974 and Health Insurance Portability and Accountability Act. If 

you have received this email in error, please advise the sender immediately and delete the entire message together with all attachments. AH 

unintended recipients are hereby notified that any use, distribution, copying or any other action regarding this email is strictly prohibited. 



~ — Original rjj 
From: 
Sent: 
To: 
Subject: 




4:04 PM 
&8 DUR-8 



One follow up question. In your opinion, would it be violation of the Privacy Act of 1974 or HIPPA 
if the QA Coordinator or pharmacy staff conducting a M&E DUR-8 reviewed other sections in a 
patient health record? 



From: 

Sent: 

To: 

Subject kL QuesBSH OrT 6HW&8 DUR-8 



i wtr^x: u WWM'-iVfm MS M IK 



»004 3:43 PM 



CDR, 

Good hearing from you. My answers follow each of your questions below. If I can be of further service feel 

free. 
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Carver, Alan CDR 



rom: 
it: 



Subject: 





04, 2004 8:39 AM 



DUR-8 



Good Morning CDR, 

Took the liberty this morning and asked our resident expert on HIPPA Policy, CAPT Gunta Obrams. Asked her what is 
policy regarding our ongoing discussion.. 

She indicates that HIPPA Policy is "THE MINIMUM AMOUNT POSSIBLE", meaning that one would review only that which 

is required and no more SO, to me there would be a breach of that policy if one were reviewing based on given criteria 

and looked at additional information. 
Hope that helps... 

HAVE A GREAT DAY. 




USCG HQ, G-WKH- 
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Carver, Alan CDR 




From: 

tent: ^Friday August Q6 2BD4 9:55 AM 

(o; 

Subject: fikcerpt from previous conversation - Re: HIPAA 

Good Morning CDR, 

the below is a reply to an earlier email ^mHHV res P on ded to regading the very same situation. I think it still applies 

and hopefully will steer you in the right wection^fyou need more info or clarification, please let me know. 

Have a Great Weekend, 




JW, Rm 5314 
Washington, DC 20593 
mfong@oonxftuscg.mil 
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First, under HIPAA, you do not need a patient's authorization to use his protected health information for quality assessment 
and improvement activities. That said, DHHS has stated that disclosure of a patient's entire medical record is NOT justified 
for this purpose; the minimum necessary standard applies for QA activities. Therefore, reasonable steps must be taken to 
limit the use of protected health information (PHI) to what is needed to accomplish the intended purpose. In this instance, it 
appears that the minimum necessary standard would limit the appropriate use of PHI to data regarding controlled 
substances. In searching through a medical record for this QA information, incidental disclosures of PHI may occur (and 
are allowable), but the incidental PHI is not part of the QA activity. 

The incident described below should be treated/logged as a HIPAA disclosure. In addition, the P/SO should counsel the 
staff member that the minimum necessary standard must be applied to QA reviews under HIPAA. While this is a HIPAA 
violation, the Privacy Rule does not prohibit the release of entire medical records for QA purposes so that the HIPAA 
violation is not an egregious one, especially since under UCMJ a member that finds another member to be in violation of 
policy (i.e. flight status requirements) is expected to properly bring this information to command attention. 

On the other hand, under employment policies and UCMJ, the use of personal information about a supervisor to attempt to 
influence the OER evaluation process is totally inappropriate and unallowable from many perspectives, and certainly must 
be addressed directly, through those channels. 

I will stand bvJA-case additional privacy/HIPAA questions arise as you get more information. 
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